Mandatory Virtual Conference - Countywide Security Assessment and Risk Analysis - 7-16-2026.pptx

RFP Title: Countywide Security Assessment and Risk Analysis Mandatory Proposal Conference

RFP#: ISD126-ADM-6361

Department: Innovation and Technology Division: Finance and Administration

DATE: 7/16/2026

Name:

Christine Onyango – Staff Analyst II Jeremiah Thomas – Staff Analyst II

Department Division www.SBCounty.gov

When you change the information (Department and Division) on each of these 4 default master slides, your presentation will automatically change to reflect it. **Please be sure to change the information on each of the 4 master slides.**

House Rules San Bernardino County Team Introductions Department Program Requirements Proposal Timeline and Submission Procurement Contact Information Questions Agenda

Page ‹#›

Mandatory conference (No Proposal will be accepted and evaluated from any Proposer who fails to attend the virtual Proposal Conference ) Attendance Verification (Roll Call) – Please sign into the chat with your name/job title/the company name, and your email address (see sample below)

Please hold your questions until the end of each presentation Please submit all your questions, including the questions from today in ePro One person speaks at a time Please silence phones & electronic devices This meeting will be recorded for review and records

House Rules

San Bernardino County Team Introductions

Innovation and Technology Department (ITD) Staff

Program Requirements

Innovation and Technology Department Presenters

Robert Pittman, CISO

Jason Hill, Deputy CISO – Threat Intelligence

Program Requirements (2)

Comprehensive Countywide Information/Cyber Security Assessment

PROJECT DESCRIPTION

PRONG-ONE: Countywide SARA (Security assessment and risk analysis) Conducted during first year of engagement Scan every County internet protocol (IP) address (w/exceptions) Follow-up health checks occurring between six (6) and eighteen (18) months after completion of the SARA Forty-seven (47) departments are stated (designations are noted for Health Care Component and Separate Legal Entities)

SERVICES AND ACTIVITIES (not inclusive) Manual Attack Testing External (Internet) Network Penetration Testing Internal Network Penetration Testing Physical Assessment Wireless Penetration Testing Firewall Review Mobile Device Social Testing Security Architecture and Configuration Review Vulnerability Scanning

Program Requirements (3)

PRONG-TWO: HIPAA Gap and Risk Analysis Conduct a HIPAA and the HITECH (Health Information Technology for Economic and Clinical Health Act of 2009) gap and risk analysis A gap and risk analysis for Covered Departments will occur every two (2) years via a County coordinated effort to provide a holistic, consistent risk measurement process, and aggregated reporting HIPAA Covered Departments may engage the Consultant during the off-years from the County-coordinated process, as needed for additional gap and risk analysis services

SERVICES AND ACTIVITIES

Title 45 of the CFR is the baseline for these activities:

HIPAA Risk Analysis (same activities conducted in PRONG-ONE) HIPAA Security Rule Gap Analysis HIPAA Privacy Rule Gap Analysis

Program Requirements (4)

PRONG-THREE: Buffet Style Services and Activities (Optional for Depts.)

Each County department can select from a buffet menu of Assessment services and activities as a line-item that is an independent activity after the previous PRONG-ONE and PRONG-TWO efforts Our departments can select these services/activities to assess compliance with a variety of policies and regulations, such as:

Personally Identifiable Information Other regulatory compliance to be achieved depending on the requirements such as, but not limited to:

Criminal Justice Information Services (CJIS) Security Policy for California Family Educational Rights and Privacy Act (FERPA) Follow-up health checks after completion of the Assessment engagement and reports have been delivered

BUFFET STYLE SERVICES (not inclusive) Administration Exercises Operations Risk

Program Requirements (5)

WORKING RELATIONSHIP

Program Requirements (6)

Program Requirements (7)

Program Requirements (8)

PROJECT MILESTONES, TASKS AND DELIVERABLES

Program Requirements (9)

Program Requirements (10)

EXHIBITS SUMMARY

“A” – IP Summary for all Departments/Separate Entities (All PRONGS)

IP addresses will not exceed 55,000 unique host IPs (i.e., Active IPs)

Specific IP addresses and their ranges will be provided when appropriate and prior to the start of the engagement by establishing the detailed Project Work Plan

Some IPs will be EXCLUDED (e.g., medical devices) and identified during the planning phase of this engagement

Program Requirements (11)

“B” – HCC Department Locations (PRONG-TWO)

Program Requirements (12)

“C” – Price Quotation and Schedule (PRONG-ONE and PRONG-TWO)

All price quotations must be for the full services, tasks, and deliverables identified in this RFP, so that County can compare proposals on an equivalent basis

Any and all exceptions, qualifiers, restrictions, and respective adjustments to the price quotations must be identified and fully described alongside the relevant task or deliverable

See next slide for excerpted chart

Program Requirements (13)

Program Requirements (14)

Program Requirements (15)

Program Requirements (16)

Program Requirements (17)

“D” – Price Quotation and Schedule (PRONG-THREE)

Program Requirements (18)

“E” – Timeline (All PRONGS)

Illustrated below is the timeline that must be achieved

Six-month timeline enables all departments listed as a HIPAA covered entity to be evaluated starting at the same time with the administration component. Once the ADMIN component is completed for a department, that department will be assessed for the technical component, etc.

The below dates are subject to change as deemed necessary

Procurement Timeline

RFP contacts:

Note: Email both contacts simultaneously Email: Christine.Onyango@itd.sbcounty.gov Phone: 909-388-5943 Email: Jeremiah.Thomas@itd.sbcounty.gov Phone: 909-388-0641 eProcurement System (ePro) Questions/Issues epro.vendor@pur.sbcounty.gov Phone number: (909) 387-2060

Procurement Contact Information

Proposals will not be accepted by email or facsimile. Proposals must be submitted electronically through the County Electronic Procurement Network (ePro).

All Proposers must register with the ePro system prior to the date and time to submit the proposal, or they will be disqualified.

RFP Proposal Submission Method

Questions for the conclusion image1.png image2.png image3.png image7.png image8.png image9.png image10.png image11.png image12.jpg image13.jpeg image14.jpeg image15.jpg image16.jpg image17.jpg image18.png image19.jpg image20.jpeg image21.jpg image22.jpeg image23.jpg image24.jpg image25.png image26.png image27.png image6.emf